RBAC

Question 1

What is the purpose of RBAC in Kubernetes?

Answer 1

RBAC is used to control what actions a user or service account can perform on specific resources in the cluster.

Question 2

What Kubernetes object is used to define a set of permissions for a namespace?

Answer 2

A Role object defines a set of permissions within a namespace.

Question 3

What three fields are used inside each RBAC rule?

Answer 3

Each RBAC rule is built from apiGroups resources and verbs.

Question 4

How do you specify the core API group in a Role rule?

Answer 4

For core resources such as pods you leave the apiGroups field empty.

Question 5

In the lecture example what resources and actions were given to the developer role?

Answer 5

The developer role was allowed to work with pods using verbs such as get list create and delete and was also allowed to create ConfigMaps.

Question 6

What object connects a user to a Role in Kubernetes RBAC?

Answer 6

A RoleBinding connects a user group or service account to a Role.

Question 7

What are the two main sections inside a RoleBinding spec?

Answer 7

A RoleBinding mainly uses subjects to define who gets access and roleRef to define which Role is being granted.

Question 8

Are Roles and RoleBindings namespaced or cluster scoped?

Answer 8

Roles and RoleBindings are namespaced objects and their permissions apply only within that namespace.

Question 9

How do you give a user access in a different namespace?

Answer 9

You create the Role and RoleBinding in that target namespace instead of the default namespace.

Question 10

Which command lets you check whether your current identity can perform an action?

Answer 10

kubectl auth can-i lets you test whether an action is allowed.

Question 11

How can an administrator test another users permissions without logging in as that user?

Answer 11

An administrator can use kubectl auth can-i with the –as option to impersonate that user.

Question 12

How can you test whether a user can perform an action in a specific namespace?

Answer 12

Use kubectl auth can-i with the action and resource plus the namespace option such as -n.

Question 13

What does the resourceNames field in an RBAC rule let you do?

Answer 13

The resourceNames field lets you restrict access to specific named resources instead of all resources of that type.

Question 14

In the lecture example how could resourceNames be used for pods?

Answer 14

It could be used to allow access only to specific pods such as blue and orange instead of every pod in the namespace.

Question 15

What is a very important CKAD distinction related to Roles that is useful to remember even beyond this lecture?

Answer 15

Role and RoleBinding are namespaced while ClusterRole and ClusterRoleBinding are used for cluster wide permissions.